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Since the invention of Bennett-Brassard 1984 
(BB84) protocol [^, many qnantum key distri¬ 
bution (QKD) protocols have been proposed [3- 

and some protocols are operated even in field 
environments One of the striking fea¬ 

tures of QKD is that QKD protocols are prov- 
ably secure unlike cryptography ba sed on com¬ 
putational complexity assumptions It has 

been believed that, to guarantee the security of 
QKD, Alice and Bob have to monitor the statis¬ 
tics of the measurement outcomes which are used 
to determine the amount of the privacy ampli¬ 
fication to generate a key fl^ . Recently a new 
type of QKD protocol, called round robin differ¬ 
ential phase shift (RRDPS) protocol, was pro¬ 
posed, and remarkably this protocol can gener¬ 
ate a key without monitoring any statistics of the 
measurement outcomes |13l| . Here we report an 
experimental realization of the RRDPS protocol. 
We used a setup in which Bob randomly chooses 
one from four interferometers with different pulse 
delays so that he could implement phase differ¬ 
ence measurements for all possible combinations 
with five-pulse time-bin states. Using the setup, 
we successfully distributed keys over 30 km of 
fiber, making this the first QKD experiment that 
does not rely on signal disturbance monitoring. 

One may wonder what makes such a fundamentally 
big difference in the RRDPS protocol. To answer this 
question, let us briefly explain the crux of the RRDPS 
protocol. The RRDPS protocol is similar to the original 
differential phase shift (DPS) protocol @ in the sense 
that both protocols employ trains of L coherent pulses 
as an information carrier sent by the sender (Alice), and 
each of the pulses is phase modulated to incur either 
0 or TT optical phase shift according to Alice’s random 
choice. A crucial difference of the RRDPS protocol from 
the DPS protocol lies in the receiver (Bob)’s detection 
unit. In the DPS protocol, Bob’s setup reads out the 
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relative phase of two adjacent pulses, while that of the 
RRDPS protocol randomly picks up two pulses among L 
pulses and reads out the relative phase of the two pulses. 
This random choice puts an additional difficulty on top of 
the DPS protocol in eavesdropping, and roughly speaking 
the amount of the privacy amplification per sifted key 
bit is given by h (yj(L — 1)), where h{x) := —x log 2 x — 
(1 — a;)log 2 (l — x) is the binary entropy function and 
V the total photon number contained in L pulses. This 
means in particular that as L increases, the amount of 
the privacy amplification decreases. Since the privacy 
amplification factor does not depend on the parameters 
related to signal disturbance, the RRDPS protocol is in 
principle highly robust against channel disturbance for 
large L, and it paves a new route toward QKD over long 
distances and under much more harsh environment. 

The receiver’s setup in the original proposal [l^ as¬ 
sumed a single interferometer with an active variable de¬ 
lay, which is not so easy to realize with high speed and 
good stability. Here, as the first demonstration, we have 
realized a variable delay line up to 4-pulse delay by pas¬ 
sively choosing one interferometer out of four interferom¬ 
eters. 

In the RRDPS protocol using a laser source, Alice pre¬ 
pares a packet of L coherent optical pulses and modulates 
each pulse with a phase shift of either 0 or tt. The state 
of the whole packet is given by 

L 

14-) =(g)|ae*-^'“)fc (1) 

fc=i 

where |Q;e®‘^'=)fe denotes the coherent state of the fcth 
pulse. Here, the amplitude a is related to the average 
photon number pt per pulse as |ap = pL and the phase 
4>k = {OjTt}. Let V be the total photon number in a 
packet. Then, the probability of finding more than t'th 
photons in a packet is given by 

Pr(^^ > ^^th) < := 1 - V -■ (2) 

^' i/i 

v=0 

Here, vth is an integer constant chosen in the proto¬ 
col. The packet is transmitted over a quantum chan¬ 
nel and sent to Bob. Bob inputs the packet into a de¬ 
layed interferometer whose delay time were randomly 
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FIG. 1: Experimental setup for RRDPS QKD. IM: intensity modulator, PM: phase modulator, ATT: attenuator, D: 250-ps 
delay line, SSPD: superconducting single photon detectors. Inset: pulse interference at MT-delay interferometer (L = 5, 
M = 2, T = 500 ps). 


chosen from {T, 2T, • • • ,{L— I)T}, where T is the tem¬ 
poral interval between adjacent pulses. When the MT- 
delay (M S {1, 2, • • • , L — 1}) is chosen, Bob observes 
photon interferences in L — M slots (see inset in Fig. 
[1]). At those time slots, a photon is output from the 
port 0 (1) when the phase difference between the fth 
{i £ {1, 2, • • • ,L — M}) and (z -I- M)th pulses was 0 (tt). 
Bob recognizes a photon detection events as one bit of 
sifted key when they are in the interference slots, and 
records the time slot, the detected port, and the delay 
used in the measurement. After repeating the same pro¬ 
cedure many times, Bob announces over an authenticated 
classical channel to Alice the indices of the successfully 
detected packets together with the recorded time slots 
and delays. This is enough for Alice to determine her 
sifted key from her record of the phase shifts applied on 
the transmitted pulses. 

Eve’s knowledge on the sifted key can be bound by the 
argument in [l^ . which is summarized as follows. We can 
regard each bit of Alice’s sifted key as the outcome of the 
.Z-basis measurement on a virtual qubit. The probabil¬ 
ity of the qubit being found in state |0) — |1) if it were 
measured in the X basis is called the “phase error rate,” 
and it determines a sufficient amount of privacy ampli¬ 
fication. It can be shown that the phase error rate is 
bounded by — 1) when the number of photons in 

a packet is no larger than izth [I^l- Then, the phase error 
rate for the use of light source satisfying Eq.([2]) can be 
no larger than 




Q = fV/7Vem 


Vfh 

L-V 


( 3 ) 

( 4 ) 


where N is the sifted key length and iVem is the num¬ 
ber of packets emitted from Alice. The first term of Eq. 
([3]) corresponds to the fraction of a sifted key where the 
number of emitted photons in a packet may have ex¬ 
ceeded vth and thus has to be regarded as a phase error 
in the worst case scenario. The net secure key length in 
the asymptotic limit is then given by 


G = iV [1 - fh{ehit) - /i(eph)], (5) 

where Cbit is the bit error rate and / corresponds to the 
parameter related to the efficiency of the employed er¬ 
ror correcting code. Eqs. m and m indicates that the 
privacy amplification factor for the RRDPS protocol de¬ 
pends only on the photon number characteristics of the 
source, the length of the packet, and the sifted key rate, 
while it is independent of the error rate. In this manner, 
the RRDPS protocol does not require the phase error 
estimation using the randomly sampled test bits unlike 
other QKD protocols, and thus possibly simplifies the 
system significantly. 

Figure [T] shows the experimental setup. Alice gener¬ 
ated optical pulses with 60 ps temporal width at a clock 
frequency of 2 GHz by modulating a 1551.1-nm coherent 
light from an external cavity diode laser using a lithium 
niobate intensity modulator. The time interval between 
the adjacent pulses is T = 0.5 ns. The phases of the 
pulses were modulated by 0 or tt using a lithium niobate 
phase modulator driven by a signal from a 2-GHz pseudo¬ 
random bit pattern (PRBS) generator. Then, the pulse 
train was launched into an optical attenuator so that the 
average photon number per pulse became much less than 
1. We defined a packet for every 5 pulses (L = 5) in the 
pulse train, and assigned “packet number” and “time slot 
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FIG. 2: Example of packet configuration and interference pat¬ 
tern at each interferometer. 


number” to each packet and pulse for the data processing 
(Fig. [5]). The packets were then sent to Bob through a 
transmission fiber. 

Since we set L = 5, Bob needs to randomly choose 
one from four delay length {T, 2T, 3T, 4T} in a variable- 
delay interferometer in the implementation in the origi¬ 
nal paper [l^. In this experiment, we employed a pas¬ 
sive configuration that composed of a 1-input, 4-output 
optical splitter followed by 4 interferometers that have 
{0.5,1.0,1.5, 2.0}-ns temporal delays. Note that a sim¬ 
ilar multi-interferometer configuration was proposed to 
increase the probability of error caused by the intercept- 
and-resend attack against the DPS protocol M- Since a 
valid outcome in the RRDPS protocol is generated when 
a packet contains a single photon, the role of the optical 
splitter can be regarded as routing the packet randomly 
to one of the 4 interferometers. The delayed interferom¬ 
eters used in the experiment were fabricated using sil¬ 
ica waveguide, and thus a precise and stable phase ad¬ 
justment was possible [T5j |. The photons from two out¬ 
put ports of each interferometer were then received by 
superconducting single photon detectors (SSPD) based 
on NbN nanowires (Scontel). Although 8 detectors are 
needed for the passive configuration with 4 interferom¬ 
eters, we employed a temporal multiplexing technique 
to reduce the required number of detectors by half. As 
shown in Fig. [U a port from T-delay (3T-delay) in¬ 
terferometer was delayed by 250 ps and combined with 
that from 4T-delay (2T-delay) interferometer using a 3- 
dB coupler, and input into an SSPD. The drawback of 
this temporal multiplexing is an additional 3-dB loss in¬ 
duced by the coupler. The detection signals from each 
SSPD were input into a time interval analyzer (Pico- 
quant) for recording the detection time instances and 
which-detector information. The detection efficiencies of 
the SSPDs were around 19% at a dark count rate of ^ 2 
cps. The overall system loss (including the detection effi¬ 
ciencies of SSPDs) was 12.7 dB. We applied a 200-ps time 
window to the obtained data to reduce the contribution 
of dark counts. 

Figure [His an example of interference pattern that is 
observed by Bob. Although we can observe interference 
in every time slot (as in original DPS protocol), we only 


use detection events that are obtained from the interfer¬ 
ence between two pulses within the same packet, which 
are shown by yellow cells in Fig. |H When we observe 
only one detection event in the yellow cells for a packet, 
we record the event as a new bit of the sifted key. We can 
estimate the frequency of Bob receiving two or more pho¬ 
tons in a packet by observing the “double clicks” between 
the detection events at detectors “Ch 1 or Ch 2” and “Ch 
3 or Ch 4” in yellow cells in a packet. Note that such an 
event does not produce a bit of the sifted key. When the 
number of double-click events is N^, the fraction in the 
A^-bit sifted key that originated from the multi-photon 
received packets is no larger than '■= SN^/N. The 
modified secure key length in the asymptotic limit that 
takes account of qd is given by (see Method for details) 


G = N[I - //i(ebit) - gd - (1 - gd)/j(eph)], 

/ _ ^src Csrc \ ^th 

“ Q(1 -qd) \ ~ Qil-qd)) 


( 6 ) 

(7) 


The parameter qd was included in the calculation of the 
amount of privacy amplification in our experiments, but 
the effect was almost negligible since qd was less than 
10“^ in all the runs. 

We undertook key generation experiments with various 
channel loss values. At each loss, we performed sifted key 
generation for an effective data acquisition time of 260 
s. We optimized the average photon number per pulse 
for each loss as in Fig. |3| (b) to maximize the secure 
key length based on the calculation described in Method. 
Figure 131(c) shows the error rate as a function of channel 
loss. The error rate at 0 channel loss was 1.5%, which 
was limited by the imperfect extinction ratio of the de¬ 
layed interferometers. The asymptotic secure key rate 
obtained in the experiment is plotted in Fig. 131(a), where 
squares and circles denote fiber transmissions and optical 
attenuation, respectively. Here, we calculated secure key 
rates using Eq. (jS]) with experimentally obtained sifted 
key lengths, error rates and the numbers of double-click 
events, with the assumption of / = 1.1. The results indi¬ 
cate that asymptotically we can generate secure keys up 
to 8.7 dB channel loss, and secure key distribution over 
a 30-km fiber was realized. 

We then have analyzed the security accommodating 
the effect arising from the finiteness of the sifted key 
length, with a choice of the security parameter d = 2“^°. 
The detailed procedure of finite-key security analysis is 
shown in Method. We first performed the analysis on 
the same data shown in Fig. |31 The obtained secure key 
length is shown in Fig. 2] (a). It shows that we success¬ 
fully generated secure keys up to 20 km of fiber (4.7 dB 
loss) with finite-key effect considered. We also undertook 
measurements with varied data acquisition times at 0-dB 
transmission loss and 20-km fiber transmission to assess 
the sifted key length dependence on the secure key. The 
result is shown in Fig. |l|(b), where the fraction of the se¬ 
cure key length obtained with finite-key security analysis 
relative to the asymptotic secure key length is plotted as 
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FIG. 3: Experimental results, (a) Secure key rate per pulse in the limit of asymptotic key length as a function of transmission 
loss, (b) Average photon number per pulse used in the experiments for each transmission loss, (c) Bit error rate as a function 
of transmission loss. In (a) - (c), the squares and circles denote fiber transmissions and optical attenuation, respectively. The 
solid curves in (a)-(c) are calculated from Eq. (O with the average photon number per pulse optimized to maximize the secure 
key rate at each transmission loss (see also Method) 
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FIG. 4: Results of finite-key security analysis, (a) Secure key 
length as a function of transmission loss for a effective data 
acquisition time of 260 s. Squares: 20-km fiber transmission, 
circles: optical attenuation, (b) Fraction of the secure key 
length obtained with finite-key security analysis relative to 
the asymptotic secure key length as a function of sifted key 
length. Circles and squares denote 0-dB transmission loss and 
20-km fiber transmission. 


a function of the sifted key length. When the fiber length 
is 0 (denoted by circles), the fraction was 50% and 93% 
for sifted key lengths of 420 kbits (effective data acquisi¬ 
tion time: 26 s) and 21 Mbits (1300 s), respectively. We 
also obtained a secure key fraction of 80% at 20-km fiber 
length with a sifted key length of 5.1 Mbits taken in a 
2600-s data acquisition time. 

The analysis in [T^ predicted that the performance of 
the RRDPS protocol can be superior to BB84 protocols 
with decoy states at large error rate. However, in our 
experiment with L = 5 and the baseline system error of 
1.5%, the secure key compression factor in the asymp¬ 
totic limit 1 — //i(ebit) — h(eph) is ^ 0.94 even if Cph is 
assumed to be 1/4 (i.e. vth = 1 and no multi-photons 
emitted in a packet). This means that our experiment 
was already close to the edge of secure key generation 


with the relatively small L. By using larger L, we can im¬ 
prove the performance of a RRPDS system significantly. 
Let us assume an RRPDS system with a delayed inter¬ 
ferometer whose delay length can be actively changed as 
in the original proposal [T^. We assumed that the dark 
count rate per detector, system loss and transmission loss 
are 2 cps, 12.7 dB and 4.7 dB (corresponding to 20 km 
fiber in our experiment), respectively, and calculated the 
maximum system error rate with which we can obtain 
secure key for each L. The result is shown in Table SI in 
Supplementary Information. It is obvious that the tol¬ 
erable error rate becomes much higher as we increase L. 
The finite-key effect is also improved for a large L. For 
example, at 20-km fiber length and L = 32, 60% of the 
asymptotic key rate is achieved with the sifted key length 
of only 3 x 10'^. Thus, if we implement larger L, we can 
expect significant improvement in the performance. 

The use of optical waveguide technologies will facilitate 
the implementation of a larger number of delays. Silica- 
waveguide-based optical delay lines whose lengths are as 
long as 4 m with a footprint of only 63 mm x 12 mm 
have already been reported [l^. With a 10-GHz clock 
QKD system which has been reported in [13 , we can 
implement 200T delay line with a 4-m waveguide. By 
incorporating with a fast optical switch whose bandwidth 
can be more than 10 GHz u sing silica-lithium niobate hy¬ 
brid integration technology [1^, we can realize a RRDPS 
system with >100 delays. 

Note that the present QKD setup is not “secure” as 
a whole system, which is mainly because we employed a 
PRBS as the phase modulation signal. In addition, we 
need to implement error correction and privacy amplifi¬ 
cation to claim the realization of full-QKD system. The 
former problem may be solved by the use of quantum ran¬ 
dom number generators, and the latter can be solved by 
the direct application of the existing software/hardware 
for the key distillation. Other issues in the present setup 
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are security loopholes, that is, we have assumed that all 
the devices in the experiment operate as the theory re¬ 
quire. In particular, we have assumed that there is no 
side-channel. Unfortunately, however, this is not the case 
in practice. For instance, the detection unit might be 
fragile against the so-called blight pulse illumination at¬ 
tacks, and imperfect phase/amplitude modulation by Al¬ 
ice might degrade the performance of the present setup. 
These are shared issues in most of the QKD experiments, 
and we hope in future that there will come out counter¬ 
measures to waive these problems. Even under these is¬ 
sues, the importance of the present experiments lies in 
the fact it confirmed the possibility of key generation 
with the fundamentally new QKD scheme, which paves 
a new route toward QKD systems under harsher environ¬ 
ment. 


Methods 

Security proof outline. We show an outline of a secu¬ 
rity proof against general attacks for the implementation 
used in the present experiment. There are two points 
which differentiate this experiment from one proposed 
in [T^. First, Bob does not use an interferometer with 
an actively-controlled variable delay line but employs a 
passive optical splitter followed by several interferome¬ 
ters with various temporal delays. As long as the num¬ 
ber of photons received in a packet is one, this change 
does not make any difference in security proof because 
the positive operator-valued measure (POVM) charac¬ 
terizing this measurement is the same with that using 
the variable delay line. Second, Bob cannot measure the 
number of photons directly because he uses threshold de¬ 
tectors, whereas the proof in [l^ assumes the use of de¬ 
tectors that can discriminate a single photon from two or 
more photons. This is the point where extra considera¬ 
tion is needed, since we need to estimate the number of 
the received packets containing one photon using thresh¬ 
old detectors. 

We define a double-click event as a coincidence between 
a detection event at “Chi or Ch2” and one at “Ch3 or 
Ch4”, both in the interference slots (yellow cells in Fig. 
HD of the same packet. We assume that all 4 detectors 
have the same detection efficiency. This can be modeled 
by detectors with unit efficiency and a common linear 
absorber in front of Bob’s apparatus. In TablelH we show 
the probability that a photon in each pulse goes to each 
interferometer and is detected in the interference slots. 
We see that the probability that a photon in a packet 
is detected at “Chi or Ch2” is 1/4 regardless of which 
pulse the photon is in. The same is true for “Ch3 or 
Ch4”. This means that a lower bound of the probability 
of a double-click event is 1/8 when there are two or more 
photons received in a packet. 

Although the actual measurement device cannot dis¬ 
criminate the photon number, it is in principle possible 
to measure the total photon number in each packet in 


TABLE I: The probability that a photon in each pulse goes to 
each interferometer and is detected in the interference slots. 



1st 

2nd 

3rd 

4th 

5th 

T delay (“Chi or Ch2”) 

1/8 

1/4 

1/4 

1/4 

1/8 

2T delay (“Ch3 or Ch4”) 

1/8 

1/8 

1/4 

1/8 

1/8 

3T delay (“Ch3 or Ch4”) 

1/8 

1/8 

0 

1/8 

1/8 

4r delay 0‘Chl or Ch2”) 

1/8 

0 

0 

0 

1/8 


front of Bob’s apparatus without affecting any procedure 
in the protocol. Hence we may, in principle, tag every 
packet that includes two or more photons. Let be 
the number of tagged ones among the A^em packets re¬ 
ceived by Bob, and A^d be the observed number of double¬ 
click events. In the asymptotic limit of large A^mS, we 
may assume that A^mB is no larger than 8A^d- The secure 
key is obtained by subtracting the same number of bits 
[1!^ in the privacy amplification, leading to a modified 
formula for the secure key length given by Eqs. m and 
©• 

Performance estimation with experimental pa¬ 
rameters. In order to estimate the performance, we 
need to assume a channel model to determine the ex¬ 
pected asymptotic values of Q, Cbit, and pd ■= Ad/A"em- 
We denote dc and Cgys as the dark count rate of the SSPD 
(per channel) and the baseline system error rate, respec¬ 
tively. We then assume that the sifted key rate per packet 
and the bit error rate are approximated with the follow¬ 
ing equations. 


Q 

-P + (L-l)Ld, 

(8) 


^esys + {L- l)Ld,/2 

(9) 

t^bit — 

Q 

Pd ^ 

{Lfipf/16 

(10) 


Using these assumptions, we optimize p to obtain a se¬ 
cure key rate. 

Finite-key security analysis. We will obtain a secure 
key length G{ and a security parameter d from 6 pro¬ 
tocol parameters iVd, -^mAj-^phj Sxj and s^. As the 
security parameter d, we adopt half the trace distance 
between the actual state pabe and an ideal state p^a^b^- 
We define a function for the tail distribution for finding 
no fewer than k successes in a binomial distribution as 



If k/n > p, it is bounded by f{k;n,p) < 2 nD{k/n\\p) ^ 
where D{q || p) :=q\og 2 {q/p) + (I - 9) log2{(l - g)/(l - 
p)}. The similar function for no more than k successes is 



which is bounded by g{k;n,p) < 2 '^D{k/n\\p) ^ p 
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After a sifted-key generation session is finished, Bob 
first examines the number of double-click events N^. If 
it is larger than a pre-defined threshold iVd, Alice and 
Bob discard the key. 

We analyze two cases separately according to the num¬ 
ber A^mB of multi-photon packets (the tagged packets) 
received by Bob’s apparatus. If A^mB is larger than a pre¬ 
defined threshold IVmB, Alice and Bob should discard the 
sifted key at least with a probability I — ei, where ei is 
defined as 

ei := 5 (iVd;iV„,B,l/ 8 ). (13) 

Since producing no key is regarded as an ideal state, the 
security parameter is bounded as d < ei. 

For the case with A^mB < .^mB, we can choose N' := 
N — fVmB untagged packets from the N packets resulting 
in the A^-bit sifted key. We then apply the security argu¬ 
ment in [l^ to these N' packets, which is summarized as 
follows. For each of the A’em packets emitted from Alice, 
we may assume that Alice is left with L qubits such that 
measurement of each qubit in the standard basis {| 0 ), | 1 )} 
would reveal the corresponding phase shift { 0 , 7 r}. On 
the other hand, the statistics of the L qubits measured 
in the {|+),|—)} basis, where |±) = -^(| 0 )± | 1 )), are 
related to the property of the light source. Let n_ be 
the number of qubits found in state |—). Then we have 
Prob(n_ > i/th) < Csrc- Whenever Bob succeeds in detec¬ 
tion, Alice may convert the L qubits into a single qubit 
(we call it a sifted qubit) and then measures it in the 
standard basis to determine her sifted key bit. For the 
purpose of proving the security, we ask what happens 
if Alice measures the sifted qubit in {|+), |—)} basis in¬ 
stead. We call the outcome for state |—) a phase error. It 
was shown [l^ that the probability of obtaining a phase 
error is no larger than n_/ {L — I). Then the security of 
the final key generated from the N' sifted key bits can 
be related to the failure probability pfaii of correcting the 
phases errors in the corresponding N' sifted qubits. 

The total number of phase errors in the N' sifted qubits 
is estimated as follows. For each of the A^em packets 
emitted from Alice, n_ exceeds vth at most with proba¬ 
bility Csrc • Therefore, the number A^mA of packets with 
n_ > z/th is no larger than a pre-defined threshold value 
NmA, except for a small probability defined by 

£2 := /(iVmA; A^em,esrc)- (14) 

This means that, except for the probability £ 2 , at least 
N" := N' — IVmA packets among the N' sifted packets 
satisfy n_ < z/th- We define A^ph as the number of phase 
errors in the N” packets. The number A^ph should be 
no larger than a pre-defined threshold A^ph with a prob¬ 
ability no smaller than 1 — £2 — £3, where £3 is defined 
as 

e3:=/(iVph;iV",^) . (15) 


error correction with a syndrome length 


N'h 


f A^mA + A^ph \ 

V ) 


+ Sx 


(16) 


will succeed at least with I—pfaii, where pfaii := £ 2 +e 3 +''?x 
and 77 x := 

As a result, for the case with A^mB < iVmB, the secure 
key length with the finite-length effect taken into account 
is given by 


Gi = N'- fNh{eut) - sz - N'h 

(17) 

where Sz = — log 2 ? 7 z bits are used for a verification of the 
bit error correction. The security parameter is bounded 
as d ^ T^z F 'N/^.y/pfail jl2| . 

Since any attack by Eve can be regarded as a mixture 
of the two cases analyzed above, d is always bounded as 

d < max(£i, 77 z + + £3 + zyx). (18) 

To obtain the numerical results in this paper, we set 
A^d to be A’emPd + S-^A’emPd, which makes the probabil¬ 
ity of discarding the protocol negligibly small. We fixed 
ei, £ 2 , £ 3 , and zyz to be 2“i°3/3, 2“i°3/3, 

and 2“®^, respectively. Then we determined the values 
of I Vm B.fVmA.fVph.Sv. and Sz to satisfy Eqs. (jlSl), ((Ill), 
(HU, and the definitions of zyx and r^z- This achieves the 
condition d< 2 “^°. 
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Supplementary Information 


SI: Performance improvement with larger number 
of delays 


We assume a setup that uses a single interferometer 
with an actively controlled variable delay followed by two 
single photon detectors as proposed in [l^. With this 
setup, the sifted key rate per packet and the bit error 
rate are given by 


Q 


^bit 


2 


+ Ldc, 


2 




Q 


(19) 

( 20 ) 


We assume that the system loss, the fiber loss (20 km), 
and the dark count rate per detector are the same as the 


experiment, 12.7 dB, 4.7 dB, and 2 cps, respectively. We 
also assume the use of 200-ps time window. Using Eqs. 
(El)-©, (Uni), (HSl) and (EQI), we calculated the maximum 
system error rate for each L with which we can obtain 
any key. The result is shown in Table SI. 


TABLE SI: The maximum system error rate to obtain any 
secure key for each L 


L 

6sys 

5 

2.3% 

16 

13.3% 

32 

18.6% 

64 

22.1% 

128 

24.4% 








